Privacy notice

THELL Wien, Tom Sampl GmbH, Schönbrunner Straße 30, 1050 Vienna, Austria. Phone +43 1 587 06 72, hallo@thell.restaurant.

This website is hosted by Vercel Inc. (USA). When you open a page, the server processes technically necessary data: IP address, time, page requested, browser identifier. These server logs are required for secure operation (Art 6(1)(f) GDPR) and are not combined with other data. Transfers to the USA rely on the EU-US Data Privacy Framework and standard contractual clauses.

The website content and the data from our forms are stored in a database at Neon Inc., Frankfurt region (EU). Only authorised staff of THELL Wien, Tom Sampl GmbH have access.

When you send us an event, catering, private dining or contact inquiry through a form, we process the data you enter there: name, email address, phone number, the details of your occasion and your message. The purpose is handling and answering your inquiry (Art 6(1)(b) GDPR — steps prior to entering into a contract).

Your consent to this processing is stored together with its time. We are notified of new inquiries by email; this delivery is handled by Resend (Resend Inc., USA) as a processor. We keep inquiry data for as long as the inquiry is being handled and delete it at any time on request afterwards.

Newsletter sign-up uses double opt-in. After you submit the form, we send an email with a confirmation link. Only your click on that link adds you to the list (Art 6(1)(a) GDPR — consent). Without that click you will not hear from us. This makes sure nobody signs up someone else's address, and it lets us demonstrate your consent (Art 7(1) GDPR).

We store: your email address, the time of sign-up, the time of confirmation, the language and the page on which you filled in the form. The confirmation link contains a random token of which we keep only a checksum, and it expires after seven days.

You can unsubscribe at any time: an email to hallo@thell.restaurant is enough, and we delete the address.

For table reservations and voucher orders, our booking system at reservation.thell.restaurant is embedded in the page as a window. The data entered there (name, contact details, reservation details and, for vouchers, payment details) is processed by the booking system to carry out the reservation or order (Art 6(1)(b) GDPR). Voucher payments are handled by Stripe Payments Europe, Ltd.; we do not store any payment data on this website.

When opened, this window also loads Google Ads conversion measurement (ID AW-11057302214) and sets a session cookie named PHPSESSID with a lifetime of 30 days. That is why we do not start the window by ourselves: instead you first see a placeholder explaining what will be loaded, with a button “Load window”. Only that click is your consent (Art 6(1)(a) GDPR), and it applies to this one window only. If you have already agreed to ad measurement, the window loads directly.

Without consent, not a single request goes to reservation.thell.restaurant. In that case you can book by phone on +43 1 587 06 72 — the number is shown right next to the placeholder.

Our forms check submissions on the server for automated access (a hidden control field and a timing check). No cookies are set for this. Where Cloudflare Turnstile is additionally active, Cloudflare Inc. (USA) checks the request, and your IP address may be transmitted to Cloudflare in the process (Art 6(1)(f) GDPR — protection against abuse).

As long as you have not consented to anything, this website stores exactly one entry in your browser: your decision from the cookie notice, kept in localStorage under the key “thell-consent”. It contains the categories you chose, the time, the language and an expiry date. It never leaves your device; we do not transmit it to our server. The legal basis is § 165(3) of the Austrian Telecommunications Act 2021 (TKG), because without this entry we would have to ask for your choice on every page view.

Your decision is valid for twelve months; after that we ask again. We also ask again whenever we change the list of services we use, instead of reusing the old consent.

Further cookies are added only once you consent. Analytics sets “_ga” and “_ga_” with the ID of our property. Ad measurement sets “_gcl_au”, “_gcl_aw”, “_gcl_dc” and “_gac_gb_” with our Ads ID, plus the localStorage entry “_gcl_ls”. The reservation and voucher window additionally sets “PHPSESSID” on reservation.thell.restaurant.

We ask about two things separately. “Analytics” is Google Analytics 4: page views, paths through the website, device class. “Ad measurement” is Google Ads conversion measurement: which ad led to a reservation or inquiry, and the basis for showing our ads more appropriately. You can allow one and decline the other. The provider in both cases is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Both run exclusively with your consent (Art 6(1)(a) GDPR). Before you consent, no Google script is loaded and not a single request goes to Google, not even an anonymous one. Only your click loads gtag.js.

Google Analytics 4 does not store IP addresses. The IP address is used only for a rough location lookup and discarded afterwards. Google may transfer data to the USA (Google LLC). The basis for this is the adequacy decision on the EU-US Data Privacy Framework, supplemented by standard contractual clauses. We have a data processing agreement with Google.

You can withdraw your consent at any time, with one click and without disadvantage: at the bottom of this page under “Cookie settings”, or via the same entry in the footer of every page. On withdrawal we switch off measurement, delete the cookies and the localStorage entry listed above, and reload the page so that the script already loaded disappears as well.

You have the rights of access, rectification, erasure, restriction of processing, data portability and objection. To exercise them, write to hallo@thell.restaurant. If you believe the processing violates data protection law, you can lodge a complaint with the Austrian Data Protection Authority: dsb.gv.at.